Fixed cross-browser edge-cases, an XSS, and allowed for multiple classes in zencode

Some older browsers considered DOM nodes good for merging with objects and passing as attributes to nodes. Added another condition to `is_object` to prevent that

Changed text strings to be interpreted as textnodes instead of innerHTML (security boost for free)

Added handling for `dif.oneclass.anotherclass`